SDN安全态势评估系统

发布时间：2018-06-03 14:55

本文选题：软件定义网络 + 网络安全态势　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：软件定义网络(Software Defined Network)作为一种全新的网络架构得到业界和研究人员充分的关注和研究。从数据转发面设备的设计研发到转发面与控制面的南向接口标准化的推进与完善,再到控制器中软件模块北向接口和网络应用功能的开发演进都表明软件定义网络在未来有广阔的前景。伴随着SDN的快速发展,SDN安全方面的问题越来越受到研究人员的重视,特别是如何在SDN中实现对网络数据转发面安全态势的有效检测和评估。但现有的安全研究方案很少有对SDN网络的安全态势做出量化评估。本文提出一种SDN网络安全态势评估方案,方案充分利用SDN全局、集中控制的优势,在控制器上对整个网络的安全状况进行实时监测。方案主体分为异常检测模块和网络安全态势评估模块。异常检测模块针对三类典型网络攻击的特点抽取出要在SDN中进行检测的具体特征。安全态势评估模块则根据得到的统计数据利用贝叶斯理论进行安全态势评估,并且根据不同攻击的威胁程度基于层次分析法分配不同的拟合权值。实验表明异常检测模块能快速监测到三类攻击导致的网络异常,该网安全态势评估模块能对不同威胁程度的攻击做出准确、敏捷的度量。系统简洁、灵活,以较少的资源实现对SDN网络安全状况的监测和评估。具体地将本文做了以下几点工作:1.本文出一个开放的SDN网络安全态势评估框架。框架具有开放性和可扩展性,网络开发和维护人员可以根据各自特定的需求对安全框架进行扩展,同时评估模块所得的评估结果可以被其它上层应用所使用。2.设计了对SDN网络进行安全态势评估所必须的异常检测模块。方案结合软件定义网络面临的典型威胁,给出了需要监测的具体特征以及识别方法。同时在控制器中利用SVM分类算法识别是否存在攻击,给出各类攻击的预判。3.充分利用SDN拥有全局网络视图和集中控制的特性,给出了SDN网络安全态势的感知方法。控制器对网络信息进行快速直接的收集、整理后以贝叶斯理论对信息进行量化,然后利用历史窗口机制得出各类攻击的信任值并由此给出网络在三类典型攻击下的网络安全态势。
[Abstract]:As a new network architecture, Software definition Network (Defined) has been paid much attention and researched by researchers and researchers. From the design and development of the data forwarding device to the standardization of the southern interface between the forwarding surface and the control surface, The evolution of the software module's northward interface and the network application function in the controller shows that the software definition network has a broad prospect in the future. With the rapid development of SDN, researchers pay more and more attention to the security aspects of SDN, especially how to effectively detect and evaluate the security situation of network data forwarding surface in SDN. However, there are few existing security research programs to quantify the security situation of SDN networks. In this paper, a scheme of SDN network security situation assessment is proposed. The scheme makes full use of the advantages of SDN global and centralized control to monitor the security of the whole network in real time on the controller. The main body of the scheme is divided into anomaly detection module and network security situation assessment module. According to the characteristics of three typical network attacks, anomaly detection module extracts the specific features to be detected in SDN. In the security situation assessment module, Bayesian theory is used to evaluate the security situation according to the obtained statistical data, and different fitting weights are assigned according to the threat degree of different attacks based on the analytic hierarchy process (AHP). Experiments show that the anomaly detection module can quickly detect the network anomalies caused by three kinds of attacks, and the network security situation assessment module can make accurate and agile measurement of attacks with different threat levels. The system is simple and flexible. It can monitor and evaluate the security of SDN network with less resources. Specifically, this article has done the following points: 1. This paper presents an open SDN network security situation assessment framework. The framework is open and extensible. Network developers and maintainers can extend the security framework according to their specific requirements, and the evaluation results obtained by the evaluation module can be used by other upper layer applications. The anomaly detection module is designed to evaluate the security situation of SDN network. Combined with the typical threats to the network defined by the software, the specific features and identification methods needed to be monitored are given. At the same time, the SVM classification algorithm is used in the controller to identify whether there is an attack or not, and the prejudgment of all kinds of attacks is given. Taking full advantage of the global network view and centralized control of SDN, the security situation perception method of SDN network is presented. The controller collects the network information quickly and directly, and quantifies the information by Bayesian theory. Then the trust value of all kinds of attacks is obtained by using the history window mechanism and the network security situation under the three typical attacks is given.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】